Splunk Search

Timechart group by 2 fields

ReddySk
Engager

Hello,

I am trying to find a solution to paint a timechart grouped by 2 fields.

I have a stats table like:

Time                  Group    Status     Count
2018-12-18 21:00:00   Group1   Success    15
2018-12-18 21:00:00   Group1   Failure    5
2018-12-18 21:00:00   Group2   Success    1544
2018-12-18 21:00:00   Group2   Failure    44
2018-12-18 22:00:00   Group1   Success    112
2018-12-18 22:00:00   Group1   Failure    4
2018-12-18 22:00:00   Group2   Success    1544
2018-12-18 22:00:00   Group2   Failure    12

I need to get

Time                  Group1 - Success    Group1 - Failure    Group2 - Sucess    Group2 - Failure
2018-12-18 21:00:00                 15                   5               1544                  44
2018-12-18 22:00:00                112                   4               1544                  12

I wanted to use this what I somehow understood from another articles

index="sbox" type=transaction | bin _time | eval groupStatus=Group+" - "+Status |  timechart count as total by groupStatus

but it is giving me...

Time                      NULL
2018-12-18 21:00:00       1608
2018-12-18 22:00:00       1672

Can you please advise the right syntax?

Thank you,
Rudo

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
Happy Splunking!

ReddySk
Engager

Thank you. It helped.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...